Linca

Privacy policy

Effective date: 6 November 2026. For Users who created their account before this date, this version applies from the moment they accept it in the application, and no later than 20 November 2026.

In accordance with Article 13 et seq. of the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR"), we provide you, as a user of Linca, the AI phone assistant (hereinafter "User"), with this Information on Personal Data Processing — setting out the conditions under which your personal data is processed.

Linca, the AI phone assistant, is a software application using elements of artificial intelligence, provided by SLAI labs s.r.o. (hereinafter "SLAI labs"), which answers calls on your behalf. Linca conducts conversations with the Caller on your telephone number, creates a recording of the call, and generates a transcript or summary (hereinafter "Linca"). This enables the User to handle requests as quickly and efficiently as possible.

If you are a Caller (an individual who called a Linca application User), this Information does not apply to you. For information on how we process your data, please read the Information on Personal Data Processing for Callers.

1. Who is the Controller of Your Data

The controller of your data as a User is SLAI labs, with registered office at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic, Company ID: 24010065, email: jiri@linca.io.

2. Who is the Processor of Caller Data

For the personal data of Callers (caller number, call metadata, Call Summaries), you as the User are the controller, because the calls are made to your telephone number and the Call Summaries serve your business. We process this data on your behalf as the Processor, under the Data Processing Agreement, which forms part of the terms of service. The processing of Caller data is described in the Information on Personal Data Processing for Callers.

Exception: for the purpose of reporting unsolicited and fraudulent calls to public phone-number databases, the controller of Caller data is SLAI labs.

3. To Whom Data May Be Transferred

We share data with the following entities, some of which are based outside the EU:

  1. ElevenLabs Inc. (real-time speech-to-text conversion, transcription, audio processing, USA): processes ephemeral audio data streams and ephemeral call transcripts for real-time speech-to-text conversion. Transfers are governed by SCCs, with TIAs and additional safeguards.
  2. Twilio Ireland Ltd. and Telnyx Ireland Ltd. (telecommunications infrastructure, WebSocket communication): processes caller numbers, call routing data, and audio streams, which are passed to ElevenLabs. Covered by the EU–US Data Privacy Framework (DPF).
  3. Google Ireland Ltd. (cloud provider: infrastructure, databases, servers, hosting, crash reporting, AI services; EU): may process device identifiers, IP addresses, account data, call metadata, audio, and transcripts within the scope of hosting; processes ephemeral call transcripts and metadata solely for the purpose of generating real-time call summaries. Covered by the EU–US DPF.
  4. Mixpanel, Inc. (analytics, EU): receives pseudonymous user identifiers, usage events, the app install source and voluntary onboarding answers. Processing takes place in the EU; any transfer outside the EU is based on SCCs.
  5. Plus Five Five, Inc. (email delivery via Resend, USA): used for sending transactional emails. Transfers outside the EEA/UK rely on Standard Contractual Clauses (via their DPA).
  6. ProfiSMS s.r.o. (SMS delivery, Czech Republic): used for sending transactional SMS messages. Processing takes place within the European Union.
  7. Functional Software, Inc. (diagnostics, possible EU residency): receives pseudonymous identifiers and application error logs. Processing in the EU when configured; transfers outside the EU based on SCCs.
  8. tawk.to Inc. (customer support chat via in-app browser): processes User messages, device data, and pseudonymous identifiers. Transfers outside the EU based on SCCs.
  9. Operators of public phone-number databases that serve to protect against unsolicited and fraudulent calls (EU): on an incoming call we check the Caller's number with them. If you have reporting switched on, or you report a call manually, we pass them the Caller's number, the category and rating of the call and the day of the call. We do not pass on any data about you. Current list of partners.
  10. Meta Platforms Ireland Ltd. (measurement of ads on Facebook and Instagram, Ireland): the Meta SDK in the app sends Meta the app install and the completed sign-up as events, together with device and app data (device model, operating system version, app version, language, time zone) and the IP address. The app does not ask for tracking permission (App Tracking Transparency) and does not collect the advertising ID (IDFA/GAID). We do not send Meta your telephone number. We pass the data to Meta Platforms Ireland Ltd. in the EU; its transfers to the USA are covered by the EU–US DPF (Meta Platforms, Inc. is certified).
  11. Apple Distribution International Ltd. (attribution of installs from Apple Ads, Ireland): on iOS, the app sends Apple a token that the Apple AdServices framework generates on the device. For an install from an Apple Ads ad, Apple returns the campaign, ad group, keyword and ad (IDs only), the type of conversion (download or redownload), whether you tapped or only viewed the ad, the ad placement and the country or region of the campaign. The app does not ask for tracking permission (App Tracking Transparency). Apple's transfers outside the EU are based on SCCs.

We do not sell your personal data. We do not share it with advertisers; we pass Meta and Apple only the data listed in items 10 and 11, to measure and optimise our own ads.

Copies of the SCCs can be requested at jiri@linca.io.

4. What Personal Data Is Processed

When using Linca, we process the following categories of personal data:

We do not process or store payment data. Payments and billing are handled directly by the Apple App Store or Google Play Store, which act as the Merchant of Record.

5. Purpose of Processing and Legal Basis

PurposeLegal basis (EU/UK GDPR)Equivalent basis in US/elsewhere
Provision and operation of the service (receiving calls, generating summaries, sending notifications)Art. 6(1)(b) – contractNecessary for service provision
Generating summaries and call summarisation (mandatory feature)Art. 6(1)(b) – contractNecessary for service provision
Audio processing for speech-to-text conversion and summarisationArt. 6(1)(b) – contractNecessary for service provision
Identification of known contacts via hashed number processingArt. 6(1)(b) – contractNecessary for service provision
Customer support via in-app chatArt. 6(1)(b) – contractNecessary for service provision
Security and abuse preventionArt. 6(1)(f) – legitimate interestLegitimate interest
Analytics and diagnostics (Mixpanel, Sentry)Art. 6(1)(f) – legitimate interestLegitimate interest
Compliance with legal obligationsArt. 6(1)(c) – legal obligationLegal obligation
Measuring and optimising advertising campaigns (app install source, events sent to Meta)Art. 6(1)(f) – legitimate interestLegitimate interest
Call classification, checking the Caller's number in public phone-number databases and optional blocking of unwanted callsArt. 6(1)(b) – contractNecessary for service provision
Reporting unsolicited and fraudulent calls to public databases (SLAI labs is the controller)Art. 6(1)(f) – legitimate interest of Users and the public in protection against unsolicited and fraudulent calls, and legitimate interest of SLAI labs in a reliable number check in LincaLegitimate interest

We do not carry out automated decision-making with legal or similarly significant effects. The automated classification of calls has no such effects either.

6. Data Retention

7. Your Data Protection Rights

You may exercise the following rights in relation to the protection of your personal data:

8. How to Exercise Your Rights

Contact us via the in-app chat or by email (jiri@linca.io). We will respond within 30 days (extendable by 60 days in complex cases). Identity verification may be required.

EU/EEA citizens may lodge a complaint with their supervisory authority. In the Czech Republic, the competent authority is the Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz, email: posta@uoou.cz.

9. Security

We implement technical and organisational measures to protect data, including:

Details on data security are available upon request.

10. Children's Data

Linca is intended for users aged 16 and above. We do not collect data from children under the age of 16. If we discover that such data has been inadvertently collected, we will delete it.

11. Updates to This Document

This Information on Personal Data Processing may be updated. The most recent version will always be available in the app and at linca.io/privacy.

Changelog: